| Title | : | Heavy Hitter Flow Detection using P4-based Programmable Data Plane Switches |
| Speaker | : | Adarsha K S (IITM) |
| Details | : | Wed, 2 Apr, 2025 2:00 PM @ SSB 334 |
| Abstract: | : | In data networks, traffic flows that carry large amounts of data packets and exceed predetermined thresholds are called Heavy Hitter (HH) or Elephant flows. Such need to be handled differently by the network in order to minimize their impact on other smaller flows. In recent years, the Software Defined Networking (SDN) paradigm led to centralization of important network functions, giving network operators programmatic control over their networks. In recent years, Programmable Data Plane (PDP) switches have been developed. These enabled customization of packet headers and packet processing along with supporting in-network computations inside the data plane switch. Using SDN and PDP concepts, HH detection techniques have been shown to be implementable in PDP switches in the data plane instead of the control plane, enabling faster network response. In particular, it has been shown in earlier work that the inter-packet gap can be used to identify heavy hitters. Such schemes use a limited-size hash table for storing the flow state information and using this for the detection. However, when hash collisions occur, it is possible that a valid HH flow in the table can be replaced by a non-HH flow resulting in missed detection of HH flows. To address this problem of false negatives, our work has proposed the incorporation of the traffic flow's medium-term Packet Count (PC) feature. That is, in addition to the inter-packet gap, the number of packets carried in the flow is also considered, in an attempt to improve the detection accuracy. Counting is done only till hash collision occurs so as to reduce the range of values to be stored. This in turn the required number of bits in packet count field size in the hash table. The proposed scheme has been implemented in the PDP-specific P4 language (a high-level language designed for packet processing on programmable hardware) and run on Intel Tofino hardware. Performance evaluation has been done using CAIDA and MAWI-based real-life traffic traces. The results show that in several scenarios, the false negatives for HHs have been reduced appreciably. |
